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DETAILED ACTION 
Information Disclosure Statement 

1. The objection to the IDS's submitted on 05/13/2009 is fully considered and an initialized 
copy previously attached. 

2. Claims 1-5 and 7-10 are pending. 

3. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure: US 6987781 Bl and US 20030193696 Al. 

Response to Arguments 

6. Applicant's arguments filed 05/13/2009 have been fully considered but are not 
persuasive. 

4. The 101 rejection is withdrawn in view of applicant's argument. 

Regarding argument "a prima facie case of obviousness has not been established 
because the Office Action has neither properly determined the scope and content of the 
prior art nor properly ascertained the differences between the claimed invention and the 

prior art. Accordingly, the burden thus remains with the Examiner, as the Office Action 

has failed to clearly articulate a reason why the prior art would have rendered the 

claimed invention obvious to one of ordinary skill in the art," argument is not persuasive because 

the office has properly determined the scope, content of the prior art, properly ascertained the 

differences between the claimed invention and the prior art and addressed each and every 

limitation reasonably in light of applicant's disclosure. Sufficient and clear articulated reason 
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why the prior art would have been rendered the claimed invention obvious to one of ordinary 
skill in the art has been provided. 



Regarding argument: 

"Claim 1 recites a combination including "configuring a Media Gateway (MG) with 
an authentication key and selling a security Jala package on a network protocol, by a 
Media (iatewa\ ( ontroller ( \Ki( I." That is. claim ! requires configuring an 
authentication key and setting a security data package, on a MG. At page 6 of the 
Office Action, the Examiner acknowledges that Floryanzia and Borella fail to disclose 
this element. Indeed, these references do not pro\ ide any teaching or suggestion of 
this element." Remark page 6 par. 2. 

Argument is not persuasive what the office action discloses at page 6 of the office action is "The 
combination fails explicitly disclose configuring step before initiating an authenticating request 
as argued by the applicant" but not "configuring a Media Gateway (MG) with an authentication 
key and setting a security data package on a network protocol, by a Media Gateway Controller 
(MGC)," as applicant contends. It looks like the applicant is attacking the references 
individually, and in response to applicant's arguments against the references individually, one 
cannot show nonobviousness by attacking references individually where the rejections are based 
on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In 
re Merck & Co., 800 F.2d 1091, 23 1 USPQ 375 (Fed. Cir. 1986). The examiner has clearly 
explained in the office action that Floryanzia (on column 3, lines 54-67) teaches a Gateway 
sending an Access Token in all Registration Request messages. The Access Token contains 
information that authenticates the Gateway to the Gatekeeper. The Gatekeeper formats a 
message to an authentication server that will authenticate the information contained in 
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the token, and the server responds with either an Access- Accept or Access-Reject message 
and also see col. 2 lines 49-60; ITU-T Recommendation H.235 of February, 1998 describes 
security and encryption for H-series multimedia terminals, including H.323 and other 
H.245-based terminals. Section 10.3.3 of H.235 specifies that data structures 
carrying encrypted information, called " cryptoTokens" can be used to allow 

endpoints to authenticate themselves to one another Floryanzia on (column 4, lines 23- 

31) further discloses receiving non-encrypted authentication request information comprises 
the steps of receiving an access token comprising a general identifier value, a time stamp 
value, a challenge value, and a random value. In a related feature, the step of receiving non- 
encrypted authentication request information comprises the steps of receiving an H.235 
ClearToken comprising a general identifier value, a time stamp value, a challenge value, 
and a random value. ITU reference discloses "configuring step before initiating an authenticating 
request" (see section A.3), the MGC and gatware are exchanged information i.e. the MGC sending a 
commands/configuration like create connection, modify connection, delete connection and notification 
request. On section A.3.2.2 command parameter values are configured before time delay or MWD, or restart 
dely or transit time is calculated (see for e.g. section A.3.5, page 22, page 27, page 31). See further 
section A 3.2.2.4 for authentication after command parameter values configuration. 

The examiner is not trying to teach the invention but is merely trying to interpret the 
claim language in its broadest and reasonable meaning. Therefore, the examiner asserts 
that the system of the prior art teach or suggest the subject matter as recited in 
independent claims. Dependent claims are also rejected at least by virtue of their 
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dependency on independent claims and by other reason set forth in this office action 
dated 08/21/2009. Accordingly, rejections for all pending claims are respectfully 
maintained. 

Claim Rejections - 35 USC §103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

6. Claims 1, 4, 5 and 7-10 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over US 6961857 (Floryanzia) in view of Borella et al. 6353891 Bl. and further in view of 
"INTERNATIONAL TELECOMMUNICATION UNION, Series J: Cable Networks and 
Transmission of Television, Sound Programme and Other Multimedia Signals - 
IPCablecom Trunkinq Gateway Control Protocol (TGCP), February 2002, J.171" herein 
after (ITU). 

As to claims 1, 7 and 9, Floryanzia discloses an authentication method/system for 
network security, comprising the following configuring a Media Gateway (MG) with an 
authentication key, and setting a security data package on a network protocol, by a Media 
Gateway Controller (MGC) (Floryanzia column 3, lines 54-67; a Gateway sends an Access 
Token in all Registration Request messages. The Access Token contains information that 
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authenticates the Gateway to the Gatekeeper. The Gatekeeper formats a message 
to an authentication server that will authenticate the information contained in 
the token, and the server responds with either an Access-Accept or Access-Reject message 
and also see col. 2 lines 49-60; ITU-T Recommendation H.235 of February, 1998 describes 
security and encryption for H-series multimedia terminals, including H.323 and other 
H.245-based terminals. Section 10.3.3 of H.235 specifies that data structures 
carrying encrypted information, called "cryptoTokens," can be used to allow 
endpoints to authenticate themselves to one another....); 

during a security authentication, by the MGC, sending security authentication request 
containing a security authentication parameter to the MG using the data package (Floryanzia 
column 4, lines 23-31; receiving non-encrypted authentication request information 
comprises the steps of receiving an access token comprising a general identifier value, a time 
stamp value, a challenge value, and a random value. In a related feature, the step of 
receiving non-encrypted authentication request information comprises the steps of 
receiving an H.235 ClearToken comprising a general identifier value, a time stamp value, 
a challenge value, and a random value); 

performing an encryption calculation according to the security parameter and the 
authentication key and reporting a calculation result to the MGC, by the MG, (Floryanzia 
column 10, lines 1-43; an encryption calculation is performed according to the security 
parameter and the authentication key and/or generating CHAP protocol response using 
the alias, password, and the CHAP Challenge values that the authentication server has 
received from the Gatekeeper in the Access Request packet. In one specific embodiment, 
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the response is computed as: Response=[CHAP ID+User Password+CHAP 
Challenge]MD5 Hash .... and the Gatekeeper responds to the Gateway with a Registration 
Confirm (RCF) message); and 

determining whether the MG is legal by computing the calculation result with a result 
calculated by the MGC (Floryanzia column 10, lines 1-43; it is also determined whether the 
response it has generated matches attributes of the Access Token. The determination is 
carried out by determining whether the Response matches a Challenge that is computed 
from the Access Request message attributes as follows: Challenge=[/?an*/0»* 
valued-Gateway User Password+Time Stamp value\MD5 Hash. If the computed Response 
matches the computed Challenge, based on the values received from the Gatekeeper, then 
sending an Access Accept packet to the Gatekeeper. If the computed Response does not 
match the computed Challenge, or the alias of the requesting Gateway is not in a database 
of the authentication server, sending an Access Reject packet back to the Gatekeeper.... 
and the Gatekeeper responds to the Gateway with a Registration Confirm (RCF) 
message). 

Floryanzia fails to disclose the determining step by the MGC by computing the 
calculation result with the result calculated by the MGC. 

However Borella et al. discloses determining by the MGC whether the MG is legal by 
computing the calculation result with a result calculated by the MG (see fig. 3 and 5; wherein 
only two devices RSIP host and RSIP gateway are both used to calculate a calculated 
result based on a received parameters and determine legality). 
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Therefore it would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to modify the teachings of Borella et al. within the system of Floryanzia 
because they are analogous in hash authentication and access controlling and determination. 
One would have been motivated to incorporate the teachings to generate authentication locally 
and enhance security. 

The combination fails explicitly disclose configuring step before initiating an 
authenticating request as argued by the applicant. However reference ITU discloses configuring 
step before initiating an authenticating request (see section A. 3). 

Therefore it would have been obvious to one having ordinary skill at the time of the 
invention was made to well-known include the configuring step before authenticating because 
to authenticate the system must be configured first. 

As to claims 4, 8 and 10, Floryanzia discloses the authentication method/system for 
network security, wherein said data package comprises a security authentication request signal 
and a security authentication completion event, said security authentication request signal 
comprises a security authentication parameter, and said security authentication completion event 
comprises a security authentication result parameter (Floryanzia column 8, lines 5-34) and 
wherein the step of reporting a calculation result includes reporting by MG the calculation result 
to the MGC via a security authentication completion event in a data package (see fig. 3C element 
332 and 336 and column 3, lines 54-67). 
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As to claim 5, (Currently Amended) Floryanzia discloses the authentication method for 
network security according to claim 4, wherein the security authentication parameter is a random 
number (see col. 4 lines 23-31 and col. 10 lines 1-42; random value) 

7. Claims 2 and 3 are rejected under 35 U.S.C. 103(a) as being unpatentable over US 
6961857 (Floryanzia), Borella et al. 6353891 Bl and "INTERNATIONAL 
TELECOMMUNICATION UNION, Series J: Cable Networks and Transmission of 
Television, Sound Programme and Other Multimedia Signals - IPCablecom Trunkinq 
Gateway Control Protocol (TGCP), February 2002, J.171" herein after (ITU) and further 
in view of US 20020120760 (Kimchi). 

As to claim 2, (Original) Floryanzia, Borella et al. and ITU teach the authentication 
method for network security according to claim 1 . The combination fail to teach wherein said 
network protocol is Media Gateway Control Protocol (MGCP). 

However, Kimchi discloses wherein said network protocol is Media Gateway Control 
Protocol (MGCP) (Kimchi paragraph 0036, lines 1-17). 

It would be obvious to one of ordinary skill in the art at the time of the applicant's 
invention that the MGCP is one of the proposed upgrades for the older H. 323 standard (Kimchi 
paragraph 0036, lines 1-17). 

As to claim 3, (Original) the combination teach the authentication method for network 
security according to claim 1 . The combination fail to teach wherein said network protocol is 
H248 protocol. 
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However, Kimchi discloses wherein said network protocol is H248 protocol (Kimchi 
paragraph 0036, lines 1-17). 

It would be obvious to one of ordinary skill in the art at the time of the applicant's 
invention that the H248 is another proposed upgrade for the older H. 323 standard (Kimchi 
paragraph 0036, lines 1-17). 

Conclusion 

8. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to ELENI A. SHIFERAW whose telephone number is (571)272- 
3867. The examiner can normally be reached on Mon-Fri 6:00am-2:30pm. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nasser R. Moazzami can be reached on (571) 272-4195. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Eleni A Shiferaw/ 

Primary Examiner, Art Unit 2436 



